Welcome to Metacurity’s Friday Report, where we wrap up the infosec news into the top themes that emerged during the week.
The past seven days saw a grab bag of cybersecurity developments, including reckonings for current and former Internet giants that fell down on their security jobs. In the seemingly never-ending repercussions of its monster security breaches, Yahoo, now owned by Verizon, agreed to pay $50 million in damages and provide two years of free credit-monitoring services to 200 million people whose email addresses and other personal information were stolen in a data breach that occurred in 2013 and 2014 but wasn’t disclosed until 2016. This settlement is on top of a spate of other settlements Yahoo, Verizon and Verizon’s newly formed company Altaba has had to pay for Yahoo’s giant mess.
Then, the UK’s Information Commissioner’s Office (ICO) said Facebook had let a “serious breach” of the law take place in its role in the Cambridge Analytica scandal and fined the social media giant £500,000, or around $644,000, the maximum allowed under the old data protection rules that applied before GDPR took effect in May.
A crop of organizations is clearly falling down on the security job by failing to protect their assets and appear destined to face their own financial penalties someday. First, a portal used by insurance agents and brokers to help Americans sign up for Affordable Care Act health insurance coverage was hacked, exposing sensitive data for around 75,000 insurance-seekers. Then, a Washington-based ISP, Pocket iNet, left 73 gigabytes of essential operational data publicly exposed in a misconfigured Amazon S3 storage bucket for months.
The biggest security goof reported during the week, however, was Wolf Intelligence, which claims to sell surveillance and hacking technologies to governments around the world. Wolf Intelligence left nearly all its data, including data taken from infected targets and victims, exposed on an unprotected command and control server and a public Google Drive folder.
No bad operational security news of the week, however, topped word that Chinese spies, and sometimes Russian spies, are often listening in on Donald Trump’s phone calls on his iPhones that he prefers to use, according to U.S. intelligence sources, who are desperate to get Trump to stop spilling the beans. China, of course, denied this report and rubbed salt into the wounds by suggesting he should consider switching over to a Huawei phone made in China, which is currently banned throughout the federal government due to Chinese spying fears.
If any infosec development of the week could be called “fun,” it was the report that U.S. Cyber Command is targeting individual Russian operatives in an effort to stop them from interfering with the U.S. midterm election, by, in essence, sending them messages that warn “we see what you’re doing.” Cyber Command took this gentle route because U.S. officials want to keep Moscow from escalating in response by taking down the power grid or conducting some other reprisal.
And the fear of U.S. officials sparking an infrastructure attack is not far-fetched. A family of malware designed specifically to enable the physical destruction of industrial control systems, dubbed Triton, which was used to try to make a Saudi Arabia petrochemical plant explode in 2017, was deployed by the Russian government, FireEye reported.
A lot more happened this week, so visit our home page, check out our easy-to-scan Snacks page or search for a particular day of the week using our search function at the top of the page to see what you missed.
With that, and in the spirit of the upcoming Halloween week, we leave you with one of the scariest images anyone in IT or infosec can see.
Blue Screen of Death. #Halloween
(? via SwishSwashSwoosh on Reddit) pic.twitter.com/5ti1uvBTie
— You Had One Job (@_youhadonejob1) October 27, 2018
Be safe and be sane out there. And when you get a chance, don’t forget to support Metacurity by becoming a patron. We’ve got a lot more good stuff in store in and really need your help! Thank you.